feat: 重建 Bell 规则与预警链路 (#132)

Bell/server/tests/bell_rule_alert/integration_test.go

@@ -0,0 +1,211 @@
+package bell_rule_alert_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+
+	adminmodels "go-admin/app/admin/models"
+	"go-admin/app/bell/alert"
+	"go-admin/app/bell/evaluation"
+	"go-admin/app/bell/event"
+	"go-admin/app/bell/receipt"
+	"go-admin/app/bell/rule"
+)
+
+func TestPostgresRuleEvaluationAndAlertProjection(t *testing.T) {
+	dsn := os.Getenv("BELL_RULE_ALERT_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("set BELL_RULE_ALERT_TEST_DATABASE_URL to run the isolated PostgreSQL test")
+	}
+	db, err := gorm.Open(postgres.Open(dsn), &gorm.Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx := context.Background()
+	rules := rule.NewService(db)
+	events := event.NewService(db)
+	evaluations := evaluation.NewService(db)
+	alerts := alert.NewService(db)
+	assertOperatorAccess(t, db)
+	createOperatorUser(t, db)
+
+	eventType := "danger_area_entered"
+	location := "东门"
+	first, err := rules.Create(ctx, rule.WriteInput{Code: "area-high", Name: "高风险区域", EventType: &eventType, MinimumSeverity: "high", LocationContains: &location}, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := rules.Create(ctx, rule.WriteInput{Code: "all-high", Name: "全局高风险", MinimumSeverity: "high"}, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	otherEventType := "fire_detected"
+	_, err = rules.Create(ctx, rule.WriteInput{Code: "critical-fire", Name: "仅严重火情", EventType: &otherEventType, MinimumSeverity: "critical"}, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	created := ingest(t, events, "event-001", "东门 A 区", "high")
+	result, err := evaluations.ForEvent(ctx, created.Event.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(result.Evaluations) != 3 || len(result.Alerts) != 2 {
+		t.Fatalf("expected 3 evaluations and 2 alerts, got %d and %d", len(result.Evaluations), len(result.Alerts))
+	}
+	matched, unmatched := 0, 0
+	for _, item := range result.Evaluations {
+		if item.Matched {
+			matched++
+		} else if item.Explanation != "" {
+			unmatched++
+		}
+	}
+	if matched != 2 || unmatched != 1 {
+		t.Fatalf("unexpected match explanations: matched=%d unmatched=%d", matched, unmatched)
+	}
+
+	replay := ingest(t, events, "event-001", "东门 A 区", "high")
+	if !replay.Duplicate || replay.Event.ID != created.Event.ID {
+		t.Fatalf("idempotent replay created another fact: %#v", replay)
+	}
+	assertCount(t, db, "bell_rule_evaluations", 3)
+	assertCount(t, db, "bell_alerts", 2)
+
+	secondEvent := ingest(t, events, "event-002", "东门 A 区", "critical")
+	assertCount(t, db, "bell_alerts", 2)
+	items, total, err := alerts.List(ctx, alert.PageQuery{PageIndex: 1, PageSize: 20, Status: "open"})
+	if err != nil || total != 2 || len(items) != 2 {
+		t.Fatalf("unexpected alert list: total=%d len=%d err=%v", total, len(items), err)
+	}
+	for _, item := range items {
+		if item.EventCount != 2 || item.Status != "open" || item.Severity != "critical" {
+			t.Fatalf("open alert did not aggregate and escalate: %#v", item)
+		}
+		detail, detailErr := alerts.Get(ctx, item.ID)
+		if detailErr != nil || len(detail.Events) != 2 || len(detail.Matches) != 2 {
+			t.Fatalf("event-alert navigation is incomplete: events=%d matches=%d err=%v", len(detail.Events), len(detail.Matches), detailErr)
+		}
+	}
+
+	updated, err := rules.Update(ctx, first.ID, rule.WriteInput{Name: "高风险区域（更新）", EventType: &eventType, MinimumSeverity: "medium", LocationContains: &location}, 1)
+	if err != nil || updated.Version != 2 {
+		t.Fatalf("rule version was not incremented: version=%d err=%v", updated.Version, err)
+	}
+	if _, err = rules.SetEnabled(ctx, second.ID, false, 1); err != nil {
+		t.Fatal(err)
+	}
+	thirdEvent := ingest(t, events, "event-003", "东门 B 区", "medium")
+	thirdResults, err := evaluations.ForEvent(ctx, thirdEvent.Event.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(thirdResults.Evaluations) != 2 || len(thirdResults.Alerts) != 1 {
+		t.Fatalf("disabled rule was evaluated: evaluations=%d alerts=%d", len(thirdResults.Evaluations), len(thirdResults.Alerts))
+	}
+	var snapshot struct {
+		Version int `json:"version"`
+	}
+	for _, item := range thirdResults.Evaluations {
+		if item.RuleID == first.ID {
+			if err = json.Unmarshal(item.RuleSnapshot, &snapshot); err != nil || item.RuleVersion != 2 || snapshot.Version != 2 {
+				t.Fatalf("versioned rule snapshot missing: item=%#v snapshot=%#v err=%v", item, snapshot, err)
+			}
+		}
+	}
+
+	if err = db.Model(&evaluation.Evaluation{}).Where("event_id = ? AND rule_id = ?", created.Event.ID, first.ID).Update("explanation", "tampered").Error; err == nil {
+		t.Fatal("immutable evaluation update unexpectedly succeeded")
+	}
+
+	if err = db.Exec(`CREATE FUNCTION bell_test_reject_alert() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'forced alert failure'; END $$`).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err = db.Exec(`CREATE TRIGGER bell_test_reject_alert BEFORE INSERT ON bell_alerts FOR EACH ROW EXECUTE FUNCTION bell_test_reject_alert()`).Error; err != nil {
+		t.Fatal(err)
+	}
+	failedID := "event-rollback"
+	_, ingestErr := events.Ingest(ctx, eventCommand(failedID, "东门 C 区", "high"), 1)
+	if ingestErr == nil {
+		t.Fatal("forced alert failure did not roll back Event ingest")
+	}
+	var eventCount, receiptCount int64
+	db.Model(&event.Event{}).Where("source_event_id = ?", failedID).Count(&eventCount)
+	db.Model(&receipt.Receipt{}).Where("source_event_id = ?", failedID).Count(&receiptCount)
+	if eventCount != 0 || receiptCount != 0 {
+		t.Fatalf("transaction failure left partial facts: events=%d receipts=%d", eventCount, receiptCount)
+	}
+	if err = db.Exec(`DROP TRIGGER bell_test_reject_alert ON bell_alerts; DROP FUNCTION bell_test_reject_alert()`).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	if secondEvent.Event.ID == thirdEvent.Event.ID {
+		t.Fatal("independent Events unexpectedly share an id")
+	}
+}
+
+func ingest(t *testing.T, service event.Service, sourceID, location, severity string) event.Result {
+	t.Helper()
+	result, err := service.Ingest(context.Background(), eventCommand(sourceID, location, severity), 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return result
+}
+
+func eventCommand(sourceID, location, severity string) event.Command {
+	return event.Command{ProducerID: "bell.rule-test", SourceEventID: sourceID, EventType: "danger_area_entered", OccurredAt: time.Date(2026, 8, 29, 0, 0, 0, 0, time.UTC), Location: location, Severity: severity, Attributes: map[string]any{"test": true}}
+}
+
+func assertCount(t *testing.T, db *gorm.DB, table string, want int64) {
+	t.Helper()
+	var got int64
+	if err := db.Table(table).Count(&got).Error; err != nil {
+		t.Fatal(err)
+	}
+	if got != want {
+		t.Fatal(fmt.Sprintf("%s count: got %d want %d", table, got, want))
+	}
+}
+
+func assertOperatorAccess(t *testing.T, db *gorm.DB) {
+	t.Helper()
+	var menuCount, readPolicyCount, writePolicyCount int64
+	if err := db.Table("sys_role_menu rm").Joins("JOIN sys_role r ON r.role_id = rm.role_id").
+		Joins("JOIN sys_menu m ON m.menu_id = rm.menu_id").
+		Where("r.role_key = ? AND m.path IN ?", "operator", []string{"/bell", "alerts", "events", "rules"}).Count(&menuCount).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Table("casbin_rule").Where("v0 = ? AND v2 = ?", "operator", "GET").Count(&readPolicyCount).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Table("casbin_rule").Where("v0 = ? AND v2 <> ?", "operator", "GET").Count(&writePolicyCount).Error; err != nil {
+		t.Fatal(err)
+	}
+	if menuCount != 4 || readPolicyCount != 6 || writePolicyCount != 0 {
+		t.Fatalf("operator access is not read-only and minimal: menus=%d reads=%d writes=%d", menuCount, readPolicyCount, writePolicyCount)
+	}
+}
+
+func createOperatorUser(t *testing.T, db *gorm.DB) {
+	t.Helper()
+	password := os.Getenv("BELL_RULE_ALERT_OPERATOR_PASSWORD")
+	if password == "" {
+		t.Skip("set BELL_RULE_ALERT_OPERATOR_PASSWORD for the HTTP RBAC continuation")
+	}
+	var roleID int
+	if err := db.Table("sys_role").Select("role_id").Where("role_key = ?", "operator").Scan(&roleID).Error; err != nil || roleID == 0 {
+		t.Fatalf("load operator role: id=%d err=%v", roleID, err)
+	}
+	user := adminmodels.SysUser{Username: "bell_132_operator", Password: password, NickName: "Bell 处置员", RoleId: roleID, DeptId: 1, PostId: 1, Status: "2"}
+	if err := db.Create(&user).Error; err != nil {
+		t.Fatal(err)
+	}
+}

Bell/server/tests/bell_rule_alert/run-postgres.ps1

@@ -0,0 +1,143 @@
+[CmdletBinding()]
+param(
+    [string]$PostgresBin = 'D:\pgsql17\bin'
+)
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+$pgStarted = $false
+$server = $null
+$testRoot = Join-Path ([IO.Path]::GetTempPath()) ('yovision-bell-132-' + [guid]::NewGuid().ToString('N'))
+$pgData = Join-Path $testRoot 'postgres'
+$pgLog = Join-Path $testRoot 'postgres.log'
+$pgCtlOut = Join-Path $testRoot 'pg-ctl.out.log'
+$pgCtlErr = Join-Path $testRoot 'pg-ctl.err.log'
+$serverOut = Join-Path $testRoot 'bell.out.log'
+$serverErr = Join-Path $testRoot 'bell.err.log'
+$serverExe = Join-Path $testRoot 'bell-server.exe'
+$serverRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+
+function Get-FreeTcpPort {
+    $listener = [Net.Sockets.TcpListener]::new([Net.IPAddress]::Loopback, 0)
+    try {
+        $listener.Start()
+        return ([Net.IPEndPoint]$listener.LocalEndpoint).Port
+    } finally {
+        $listener.Stop()
+    }
+}
+
+function Wait-Tcp([int]$Port, [bool]$Open, [int]$Attempts = 120) {
+    for ($attempt = 0; $attempt -lt $Attempts; $attempt++) {
+        $client = [Net.Sockets.TcpClient]::new()
+        try {
+            $connected = $client.ConnectAsync('127.0.0.1', $Port).Wait(250) -and $client.Connected
+        } catch {
+            $connected = $false
+        } finally {
+            $client.Dispose()
+        }
+        if ($connected -eq $Open) { return }
+        Start-Sleep -Milliseconds 250
+    }
+    throw "TCP port $Port did not reach open=$Open"
+}
+
+function Wait-Health([string]$BaseUrl) {
+    for ($attempt = 0; $attempt -lt 100; $attempt++) {
+        try {
+            $health = Invoke-RestMethod -Uri "$BaseUrl/healthz" -TimeoutSec 2 -NoProxy
+            if ($health.status -eq 'ok' -and $health.service -eq 'bell') { return }
+        } catch {}
+        Start-Sleep -Milliseconds 300
+    }
+    throw 'Bell health endpoint did not become ready'
+}
+
+New-Item -ItemType Directory -Path $testRoot | Out-Null
+$pgPort = Get-FreeTcpPort
+$bellPort = Get-FreeTcpPort
+$baseUrl = "http://127.0.0.1:$bellPort"
+$database = 'bell_132'
+
+try {
+    foreach ($required in @('initdb.exe', 'pg_ctl.exe', 'createdb.exe')) {
+        $path = Join-Path $PostgresBin $required
+        if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { throw "Missing PostgreSQL tool: $path" }
+    }
+
+    & (Join-Path $PostgresBin 'initdb.exe') -D $pgData -U postgres -A trust --encoding=UTF8 --no-locale | Out-Null
+    if ($LASTEXITCODE -ne 0) { throw 'isolated PostgreSQL initdb failed' }
+    $pgArguments = "-D `"$pgData`" -l `"$pgLog`" -o `"-p $pgPort -h 127.0.0.1`" start"
+    Start-Process -FilePath (Join-Path $PostgresBin 'pg_ctl.exe') -ArgumentList $pgArguments -RedirectStandardOutput $pgCtlOut -RedirectStandardError $pgCtlErr -WindowStyle Hidden | Out-Null
+    Wait-Tcp -Port $pgPort -Open $true
+    $pgStarted = $true
+    & (Join-Path $PostgresBin 'createdb.exe') -h 127.0.0.1 -p $pgPort -U postgres $database
+    if ($LASTEXITCODE -ne 0) { throw 'isolated Bell database creation failed' }
+
+    $env:GOTOOLCHAIN = 'go1.26.5'
+    $env:BELL_DATABASE_URL = "host=127.0.0.1 port=$pgPort user=postgres dbname=$database sslmode=disable"
+    $env:BELL_RULE_ALERT_TEST_DATABASE_URL = $env:BELL_DATABASE_URL
+    $env:BELL_JWT_SECRET = [guid]::NewGuid().ToString('N') + [guid]::NewGuid().ToString('N')
+    $env:BELL_BOOTSTRAP_USERNAME = 'bell_132_admin'
+    $env:BELL_BOOTSTRAP_PASSWORD = [guid]::NewGuid().ToString('N')
+    $env:BELL_RULE_ALERT_OPERATOR_PASSWORD = [guid]::NewGuid().ToString('N')
+    $env:BELL_HOST = '127.0.0.1'
+    $env:BELL_PORT = $bellPort.ToString()
+
+    Push-Location $serverRoot
+    try {
+        go run . migrate -c config/settings.demo.yml *> (Join-Path $testRoot 'migrate.log')
+        if ($LASTEXITCODE -ne 0) { throw "Bell migration failed; see $(Join-Path $testRoot 'migrate.log')" }
+        go test ./tests/bell_rule_alert -count=1 -v
+        if ($LASTEXITCODE -ne 0) { throw 'Bell rule-alert integration test failed' }
+        go build -o $serverExe .
+        if ($LASTEXITCODE -ne 0) { throw 'Bell build failed' }
+    } finally {
+        Pop-Location
+    }
+
+    $server = Start-Process -FilePath $serverExe -ArgumentList @('server', '-c', 'config/settings.demo.yml') -WorkingDirectory $serverRoot -RedirectStandardOutput $serverOut -RedirectStandardError $serverErr -WindowStyle Hidden -PassThru
+    Wait-Health $baseUrl
+
+    $unauthorized = Invoke-RestMethod -Uri "$baseUrl/api/v1/bell/rules" -TimeoutSec 5 -NoProxy
+    if ([int]$unauthorized.code -ne 401) { throw "unauthenticated rule list returned code $($unauthorized.code)" }
+
+    $adminLoginBody = @{ username = $env:BELL_BOOTSTRAP_USERNAME; password = $env:BELL_BOOTSTRAP_PASSWORD; code = '0'; uuid = '0' } | ConvertTo-Json -Compress
+    $adminLogin = Invoke-RestMethod -Method Post -Uri "$baseUrl/api/v1/login" -ContentType 'application/json' -Body $adminLoginBody -TimeoutSec 5 -NoProxy
+    if ([int]$adminLogin.code -ne 200) { throw 'Bell administrator login failed' }
+    $adminHeaders = @{ Authorization = "Bearer $($adminLogin.token)" }
+    $adminRule = @{ code = 'http-admin'; name = '管理员 HTTP 规则'; eventType = $null; minimumSeverity = 'high'; locationContains = $null } | ConvertTo-Json -Compress
+    $adminWrite = Invoke-RestMethod -Method Post -Uri "$baseUrl/api/v1/bell/rules" -Headers $adminHeaders -ContentType 'application/json; charset=utf-8' -Body $adminRule -TimeoutSec 5 -NoProxy
+    if ([int]$adminWrite.code -ne 200 -or [int]$adminWrite.data.version -ne 1) { throw 'administrator rule create failed' }
+
+    $operatorLoginBody = @{ username = 'bell_132_operator'; password = $env:BELL_RULE_ALERT_OPERATOR_PASSWORD; code = '0'; uuid = '0' } | ConvertTo-Json -Compress
+    $operatorLogin = Invoke-RestMethod -Method Post -Uri "$baseUrl/api/v1/login" -ContentType 'application/json' -Body $operatorLoginBody -TimeoutSec 5 -NoProxy
+    if ([int]$operatorLogin.code -ne 200) { throw 'Bell operator login failed' }
+    $operatorHeaders = @{ Authorization = "Bearer $($operatorLogin.token)" }
+    foreach ($path in @('/api/v1/bell/rules','/api/v1/bell/events','/api/v1/bell/alerts')) {
+        $read = Invoke-RestMethod -Uri "$baseUrl$path" -Headers $operatorHeaders -TimeoutSec 5 -NoProxy
+        if ([int]$read.code -ne 200) { throw "operator read $path returned code $($read.code)" }
+    }
+    $operatorWrite = Invoke-RestMethod -Method Post -Uri "$baseUrl/api/v1/bell/rules" -Headers $operatorHeaders -ContentType 'application/json' -Body $adminRule -TimeoutSec 5 -NoProxy
+    if ([int]$operatorWrite.code -ne 403) { throw "operator rule write returned code $($operatorWrite.code)" }
+    $menu = Invoke-RestMethod -Uri "$baseUrl/api/v1/menurole" -Headers $operatorHeaders -TimeoutSec 5 -NoProxy
+    $menuJson = $menu.data | ConvertTo-Json -Depth 20 -Compress
+    foreach ($title in @('预警中心','预警管理','事件查询','规则配置')) {
+        if (-not $menuJson.Contains($title)) { throw "operator menu is missing $title" }
+    }
+    if ($menuJson.Contains('系统管理') -or $menuJson.Contains('开发工具')) { throw 'operator menu exposed unrelated GoAdmin modules' }
+    Write-Output 'BELL_132_HTTP unauthenticated=401 admin_write=200 operator_reads=200 operator_write=403 minimal_menu=true'
+} finally {
+    if ($null -ne $server -and -not $server.HasExited) {
+        Stop-Process -Id $server.Id -Force
+        $server.WaitForExit(5000) | Out-Null
+    }
+    if ($pgStarted) {
+        & (Join-Path $PostgresBin 'pg_ctl.exe') -D $pgData -m fast stop *> (Join-Path $testRoot 'pg-stop.log')
+    }
+    foreach ($name in @('BELL_DATABASE_URL','BELL_RULE_ALERT_TEST_DATABASE_URL','BELL_RULE_ALERT_OPERATOR_PASSWORD','BELL_JWT_SECRET','BELL_BOOTSTRAP_USERNAME','BELL_BOOTSTRAP_PASSWORD','BELL_HOST','BELL_PORT')) {
+        Remove-Item "Env:$name" -ErrorAction SilentlyContinue
+    }
+    Write-Verbose "Bell #132 temporary artifacts: $testRoot"
+}

Bell/server/tests/bell_rule_alert/validation_test.go

@@ -0,0 +1,55 @@
+package bell_rule_alert_test
+
+import (
+	"errors"
+	"testing"
+
+	"go-admin/app/bell/rule"
+)
+
+func TestRuleNormalizeTrimsAndNormalizesFields(t *testing.T) {
+	eventType := " danger_area_entered "
+	location := " 东门 "
+	got, err := rule.Normalize(rule.WriteInput{
+		Code: " AREA_HIGH ", Name: " 高风险区域 ", EventType: &eventType,
+		MinimumSeverity: " HIGH ", LocationContains: &location,
+	}, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Code != "area_high" || got.Name != "高风险区域" || got.MinimumSeverity != "high" {
+		t.Fatalf("unexpected normalized rule: %#v", got)
+	}
+	if got.EventType == nil || *got.EventType != "danger_area_entered" || got.LocationContains == nil || *got.LocationContains != "东门" {
+		t.Fatalf("optional fields were not normalized: %#v", got)
+	}
+}
+
+func TestRuleNormalizeRejectsInvalidInput(t *testing.T) {
+	tests := []struct {
+		name  string
+		input rule.WriteInput
+	}{
+		{name: "invalid code", input: rule.WriteInput{Code: "Bad Code", Name: "规则", MinimumSeverity: "low"}},
+		{name: "missing name", input: rule.WriteInput{Code: "valid-code", Name: " ", MinimumSeverity: "low"}},
+		{name: "unknown severity", input: rule.WriteInput{Code: "valid-code", Name: "规则", MinimumSeverity: "urgent"}},
+		{name: "control character", input: rule.WriteInput{Code: "valid-code", Name: "规则\n泄露", MinimumSeverity: "low"}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if _, err := rule.Normalize(test.input, true); !errors.Is(err, rule.ErrInvalid) {
+				t.Fatalf("expected ErrInvalid, got %v", err)
+			}
+		})
+	}
+}
+
+func TestRuleUpdateKeepsImmutableCodeOutsideInput(t *testing.T) {
+	got, err := rule.Normalize(rule.WriteInput{Code: "ignored invalid code", Name: "更新后规则", MinimumSeverity: "medium"}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Name != "更新后规则" || got.MinimumSeverity != "medium" {
+		t.Fatalf("unexpected update normalization: %#v", got)
+	}
+}